Arch Video Cut

• Analyzed: May 11, 2026, 7:18 AM
• Findings: 1
• Version: 1.0.4
• Hash: db8add8354f35591067057e1d9af87288ce16b51ab73b0362b9dd3edb4271e2c
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill contains several high-risk coding practices and privacy leaks. Specifically, `scripts/full_workflow.py` uses `subprocess.run(shell=True)` to execute complex ffmpeg commands, which creates a significant shell injection vulnerability if input filenames or configuration parameters are untrusted. Furthermore, the script contains hardcoded absolute paths to a specific local user's directory (`/Users/baushua/Desktop/`), which is a privacy leak and indicates the code is not properly generalized. While the 'self-learning' system in `scripts/preference_learner.py` appears to be a benign local JSON-based preference manager, the combination of shell execution risks and hardcoded environment-specific data is characteristic of poorly vetted or potentially exploitable scripts.